log
1 row where forwarded_for = "167.71.26.162, 172.70.110.144" and remote_addr = "10.1.18.241" sorted by request_time descending
This data as json, CSV (advanced)
Link | rowid | line | measure#nginx.service | request | status_code | request_id | remote_addr | forwarded_for | forwarded_proto | via | body_bytes_sent | referer | user_agent | request_time ▲ | upstream_response_time | upstream_connect_time | upstream_header_time |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
355 | 355 | 2021-08-05T19:16:28.351501+00:00 app[web.1]: measure#nginx.service=0.241 request="GET /atom/everything/ HTTP/1.1" status_code=200 request_id=91d5fcb7-5957-47c4-8ceb-d146f556b695 remote_addr="10.1.18.241" forwarded_for="167.71.26.162, 172.70.110.144" forwarded_proto="http" via="1.1 vegur" body_bytes_sent=155913 referer="-" user_agent="NewsBlur Feed Fetcher - 555 subscribers - http://www.newsblur.com/site/5020414/simon-willisons-weblog (\x22Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.1 Safari/605.1.15\x22)" request_time="0.241" upstream_response_time="0.244" upstream_connect_time="0.000" upstream_header_time="0.236"; | 0.241 | GET /atom/everything/ HTTP/1.1 | 200 | 91d5fcb7-5957-47c4-8ceb-d146f556b695 | 10.1.18.241 | 167.71.26.162, 172.70.110.144 | http | 1.1 vegur | 155913 | - | NewsBlur Feed Fetcher - 555 subscribers - http://www.newsblur.com/site/5020414/simon-willisons-weblog (\x22Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.1 Safari/605.1.15\x22) | 0.241 | 0.244 | 0.0 | 0.236 |
Advanced export
JSON shape: default, array, newline-delimited
CREATE TABLE "log" ( [line] TEXT, [measure#nginx.service] FLOAT, [request] TEXT, [status_code] INTEGER, [request_id] TEXT, [remote_addr] TEXT, [forwarded_for] TEXT, [forwarded_proto] TEXT, [via] TEXT, [body_bytes_sent] INTEGER, [referer] TEXT, [user_agent] TEXT, [request_time] FLOAT, [upstream_response_time] FLOAT, [upstream_connect_time] FLOAT, [upstream_header_time] FLOAT );